@nu-art/permissions-backend 0.401.7 → 0.401.9

package/_entity/permission-user/ModuleBE_PermissionUserDB.d.ts

@@ -1,14 +1,15 @@
 import { DBApiConfigV3, ModuleBE_BaseDB } from '@nu-art/thunderstorm-backend';
-import { DB_PermissionUser, DBProto_PermissionUser, Request_AssignPermissions, User_Group } from '@nu-art/permissions-shared';
+import { DB_PermissionUser, DBProto_PermissionUser, Request_AssignPermissions } from '@nu-art/permissions-shared';
 import { PerformProjectSetup } from '@nu-art/thunderstorm-backend/modules/action-processor/Action_SetupProject';
 import { DB_BaseObject, UniqueId } from '@nu-art/ts-common';
-import { OnNewUserRegistered, OnUserLogin } from '@nu-art/user-account-backend';
+import { OnAccountDeleted, OnNewUserRegistered, OnUserLogin } from '@nu-art/user-account-backend';
 import { Transaction } from 'firebase-admin/firestore';
-import { UI_Account } from '@nu-art/user-account-shared';
+import { SafeDB_Account, UI_Account } from '@nu-art/user-account-shared';
 import { CollectionActionType, PostWriteProcessingData } from '@nu-art/firebase-backend/firestore-v3/FirestoreCollectionV3';
-type Config = DBApiConfigV3<DBProto_PermissionUser> & {};
-export declare class ModuleBE_PermissionUserDB_Class extends ModuleBE_BaseDB<DBProto_PermissionUser, Config> implements OnNewUserRegistered, OnUserLogin, PerformProjectSetup {
-    private defaultPermissionGroups?;
+type Config = DBApiConfigV3<DBProto_PermissionUser> & {
+    defaultPermissionGroupIds?: UniqueId[];
+};
+export declare class ModuleBE_PermissionUserDB_Class extends ModuleBE_BaseDB<DBProto_PermissionUser, Config> implements OnNewUserRegistered, OnUserLogin, PerformProjectSetup, OnAccountDeleted {
     constructor();
     __performProjectSetup(): {
         priority: number;
@@ -16,12 +17,12 @@ export declare class ModuleBE_PermissionUserDB_Class extends ModuleBE_BaseDB<DBP
     };
     __onUserLogin(account: UI_Account, transaction: Transaction): Promise<void>;
     __onNewUserRegistered(account: UI_Account, transaction: Transaction): Promise<void>;
+    __onAccountDeleted: (account: SafeDB_Account, transaction: Transaction) => Promise<void>;
     protected preWriteProcessing(instance: DB_PermissionUser, originalDbInstance: DBProto_PermissionUser['dbType'], t?: Transaction): Promise<void>;
     protected postWriteProcessing(data: PostWriteProcessingData<DBProto_PermissionUser>, actionType: CollectionActionType): Promise<void>;
     insertIfNotExist: (uiAccount: UI_Account & DB_BaseObject, transaction: Transaction) => Promise<DB_PermissionUser | (Omit<DB_PermissionUser, "_id" | "__metadata1" | "__hardDelete" | "__created" | "__updated" | "_v" | "_originDocId" | ("_auditorId" | "__groupIds")> & Partial<import("@nu-art/ts-common").SubsetObjectByKeys<DB_PermissionUser, "_id" | "__metadata1" | "__hardDelete" | "__created" | "__updated" | "_v" | "_originDocId" | ("_auditorId" | "__groupIds")>> & Partial<import("@nu-art/ts-common").DB_Object>)>;
     assignPermissions(body: Request_AssignPermissions): Promise<void>;
-    setDefaultPermissionGroups: (groupsGetter: () => Promise<User_Group[]>) => void;
-    clearDefaultPermissionGroups: () => void;
+    private getDefaultPermissionGroups;
     /**
      * The system requires to perform action, which in other cases can also be done by a human.
      * This requires system features to identify as a bot user, or "Service Account"

package/_entity/permission-user/ModuleBE_PermissionUserDB.js

@@ -1,18 +1,17 @@
 import { MemKey_ServerApi, ModuleBE_BaseDB, Storm, } from '@nu-art/thunderstorm-backend';
 import { DBDef_PermissionUser } from '@nu-art/permissions-shared';
-import { _keys, ApiException, asOptionalArray, batchActionParallel, dbObjectToId, exists, filterDuplicates, filterInstances, filterKeys, flatArray, JwtTools, merge, Year } from '@nu-art/ts-common';
+import { _keys, ApiException, asOptionalArray, batchAction, batchActionParallel, dbObjectToId, exists, filterDuplicates, filterInstances, filterKeys, flatArray, JwtTools, merge, Year } from '@nu-art/ts-common';
 import { ModuleBE_PermissionGroupDB } from '../permission-group/ModuleBE_PermissionGroupDB.js';
 import { MemKey_AccountId, ModuleBE_AccountDB, ModuleBE_SessionDB } from '@nu-art/user-account-backend';
 import { MemKey_UserPermissions } from '../../consts.js';
 import { dispatcher_collectServiceAccounts } from '@nu-art/thunderstorm-backend/modules/_tdb/service-accounts';
 export class ModuleBE_PermissionUserDB_Class extends ModuleBE_BaseDB {
-    defaultPermissionGroups;
     constructor() {
         super(DBDef_PermissionUser);
     }
     __performProjectSetup() {
         return {
-            priority: 4,
+            priority: 200,
             processor: async () => {
                 const accounts = await ModuleBE_AccountDB.query.where({});
                 const permissionsUser = await this.query.all(accounts.map(dbObjectToId));
@@ -43,6 +42,9 @@ export class ModuleBE_PermissionUserDB_Class extends ModuleBE_BaseDB {
     async __onNewUserRegistered(account, transaction) {
         await this.insertIfNotExist(account, transaction);
     }
+    __onAccountDeleted = async (account, transaction) => {
+        await this.delete.unique(account._id, transaction);
+    };
     // protected async canDeleteDocument(transaction: FirestoreTransaction, dbInstances: DB_PermissionUser[]) {
     // 	const conflicts: DB_PermissionUser[] = [];
     // 	const accounts = await ModuleBE_AccountDB.query.custom(_EmptyQuery);
@@ -82,14 +84,10 @@ export class ModuleBE_PermissionUserDB_Class extends ModuleBE_BaseDB {
     }
     insertIfNotExist = async (uiAccount, transaction) => {
         const create = async (transaction) => {
-            const defaultPermissionGroups = ModuleBE_PermissionUserDB.defaultPermissionGroups ? await ModuleBE_PermissionUserDB.defaultPermissionGroups() : [];
-            const permissionGroups = ModuleBE_PermissionUserDB.defaultPermissionGroups
-                ? filterInstances(await ModuleBE_PermissionGroupDB.query.all(defaultPermissionGroups.map(item => item.groupId)))
-                : [];
-            this.logInfo(`Received ${defaultPermissionGroups.length} groups to assign, ${permissionGroups.length} of which exist`);
+            const defaultPermissionGroups = await this.getDefaultPermissionGroups();
             const permissionsUserToCreate = {
                 _id: uiAccount._id,
-                groups: permissionGroups.map(group => ({ groupId: group._id })),
+                groups: defaultPermissionGroups.map(group => ({ groupId: group._id })),
                 _auditorId: MemKey_AccountId.get()
             };
             return ModuleBE_PermissionUserDB.create.item(permissionsUserToCreate, transaction);
@@ -137,11 +135,10 @@ export class ModuleBE_PermissionUserDB_Class extends ModuleBE_BaseDB {
         });
         await this.set.multi(usersToUpdate);
     }
-    setDefaultPermissionGroups = (groupsGetter) => {
-        this.defaultPermissionGroups = groupsGetter;
-    };
-    clearDefaultPermissionGroups = () => {
-        delete this.defaultPermissionGroups;
+    getDefaultPermissionGroups = async () => {
+        if (!this.config.defaultPermissionGroupIds?.length)
+            return [];
+        return ModuleBE_PermissionGroupDB.query.where({ _id: { $in: this.config.defaultPermissionGroupIds } });
     };
     /**
      * The system requires to perform action, which in other cases can also be done by a human.
@@ -220,7 +217,12 @@ export class ModuleBE_PermissionUserDB_Class extends ModuleBE_BaseDB {
             return isExpired ? undefined : session;
         })));
         //TODO END
-        await this.runTransaction(async (t) => Promise.all(validSessions.map(session => ModuleBE_SessionDB._session.rotate.reissue.bySession(session, t))));
+        this.logWarning(`#### Rotating ${validSessions.length} Sessions! ####`);
+        await batchAction(validSessions, 500, async (sessions) => {
+            await this.runTransaction(async (t) => {
+                await Promise.all(sessions.map(session => ModuleBE_SessionDB._session.rotate.reissue.bySession(session, t)));
+            });
+        });
     }
 }
 export const ModuleBE_PermissionUserDB = new ModuleBE_PermissionUserDB_Class();

package/modules/ModuleBE_Permissions.js

@@ -137,7 +137,7 @@ class ModuleBE_Permissions_Class extends Module {
     };
     __performProjectSetup() {
         return {
-            priority: 0,
+            priority: 100,
             processor: async () => {
                 const projects = dispatcher_collectPermissionsProjects.dispatchModule();
                 projects.reduce((issues, project) => {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@nu-art/permissions-backend",
-  "version": "0.401.7",
+  "version": "0.401.9",
   "description": "Permissions Backend",
   "keywords": [
     "TacB0sS",
@@ -35,15 +35,15 @@
     "test": "ts-mocha -w -p src/test/tsconfig.json --timeout 0 --inspect=8107 --watch-files '**/*.ts' src/test/__all-tests.ts"
   },
   "dependencies": {
-    "@nu-art/permissions-shared": "0.401.7",
-    "@nu-art/firebase-backend": "0.401.7",
-    "@nu-art/firebase-shared": "0.401.7",
-    "@nu-art/google-services-backend": "0.401.7",
-    "@nu-art/thunderstorm-backend": "0.401.7",
-    "@nu-art/thunderstorm-shared": "0.401.7",
-    "@nu-art/ts-common": "0.401.7",
-    "@nu-art/user-account-backend": "0.401.7",
-    "@nu-art/user-account-shared": "0.401.7",
+    "@nu-art/permissions-shared": "0.401.9",
+    "@nu-art/firebase-backend": "0.401.9",
+    "@nu-art/firebase-shared": "0.401.9",
+    "@nu-art/google-services-backend": "0.401.9",
+    "@nu-art/thunderstorm-backend": "0.401.9",
+    "@nu-art/thunderstorm-shared": "0.401.9",
+    "@nu-art/ts-common": "0.401.9",
+    "@nu-art/user-account-backend": "0.401.9",
+    "@nu-art/user-account-shared": "0.401.9",
     "express": "^4.18.2",
     "firebase": "^11.9.0",
     "firebase-admin": "13.4.0",
@@ -63,7 +63,6 @@
     "@types/chai": "^4.3.4",
     "@types/mocha": "^10.0.1",
     "@types/history": "^4.7.2",
-    "@types/request": "^2.48.1",
     "@types/saml2-js": "^1.6.8"
   },
   "unitConfig": {

package/permissions.d.ts

@@ -1,6 +1,7 @@
 import { DefaultDef_Group } from '@nu-art/permissions-shared';
 import { PermissionKey_BE } from './PermissionKey_BE.js';
 import { DefaultDef_Domain, DefaultDef_Package } from './types.js';
+export declare const PermissionKeyBE_AccountManagement: PermissionKey_BE<"permission-key--account-management-admin">;
 export declare const PermissionKeyBE_DeveloperViewer: PermissionKey_BE<"permission-key--developer-viewer">;
 export declare const PermissionKeyBE_DeveloperEditor: PermissionKey_BE<"permission-key--developer-editor">;
 export declare const PermissionKeyBE_DeveloperAdmin: PermissionKey_BE<"permission-key--developer-admin">;

package/permissions.js

@@ -3,7 +3,7 @@ import { defaultValueResolverV2, PermissionKey_BE } from './PermissionKey_BE.js'
 import { ApiDef_ActionProcessing } from '@nu-art/thunderstorm-shared/action-processor/index';
 import { ApiDef_CollectionActions } from '@nu-art/thunderstorm-shared/collection-actions/api-def';
 import { ApiDef_Account, DBDef_Accounts } from '@nu-art/user-account-shared';
-import { PermissionKey_DeveloperAdmin, PermissionKey_DeveloperViewer, PermissionKey_DeveloperWriter } from '@nu-art/permissions-shared/permission-keys';
+import { PermissionKey_AccountManagementAdmin, PermissionKey_DeveloperAdmin, PermissionKey_DeveloperViewer, PermissionKey_DeveloperWriter } from '@nu-art/permissions-shared/permission-keys';
 import { ApiDef_SyncEnv } from '@nu-art/thunderstorm-shared';
 // export const PermissionsAccessLevel_ReadSelf = Object.freeze({name: 'Read-Self', value: 50});
 const Domain_PermissionsDefine_ID = '48d5ace0cbb2a14c8a0ca3773a4a2962';
@@ -25,14 +25,19 @@ const _Domain_PermissionsAssign = {
     namespace: 'Permissions Assign',
     dbNames: [DBDef_PermissionGroup.dbKey, DBDef_PermissionUser.dbKey],
 };
+export const PermissionKeyBE_AccountManagement = new PermissionKey_BE(PermissionKey_AccountManagementAdmin, () => defaultValueResolverV2(_Domain_AccountManagement._id, DefaultAccessLevel_Admin.name));
 const _Domain_AccountManagement = {
     _id: Domain_AccountManagement_ID,
     namespace: 'Account Management',
     dbNames: [DBDef_Accounts.dbKey],
+    permissionKeys: [
+        PermissionKeyBE_AccountManagement,
+    ],
     customApis: [
         { path: ApiDef_Account._v1.createAccount.path, accessLevel: DefaultAccessLevel_Admin.name },
         { path: ApiDef_Account._v1.createToken.path, accessLevel: DefaultAccessLevel_Admin.name },
         { path: ApiDef_Account._v1.getSessions.path, accessLevel: DefaultAccessLevel_Admin.name },
+        { path: ApiDef_Account._v1.deleteAccount.path, accessLevel: DefaultAccessLevel_Admin.name },
     ]
 };
 export const PermissionKeyBE_DeveloperViewer = new PermissionKey_BE(PermissionKey_DeveloperViewer, () => defaultValueResolverV2(Domain_Developer._id, DefaultAccessLevel_Read.name));